Everett & Hurite Ophthalmic Association

Summary

Everett & Hurite Ophthalmic Association experienced unauthorized access to an employee email account over a one-month period, discovered during an investigation prompted by unusual activity. The organization secured the account and engaged forensic specialists, determining that patient data was present in the compromised email but finding no evidence of actual information viewing or misuse. Exposed information primarily included patient names from an internal CMS report, though some individuals' data extended to dates of birth, financial and health insurance details, Social Security numbers, and medical treatment information. The incident affected 34,113 individuals and was reported to federal health authorities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 23, 2020, Everett & Hurite Ophthalmic Association (EHOA) detected unusual activity in an employee email account, prompting immediate action to secure the account through password changes. The organization initiated an investigation with third-party forensic specialists to determine the scope and nature of the incident. Forensic analysis revealed unauthorized access to the single email account between February 25, 2020, and March 25, 2020. While investigators could not confirm whether specific information within the account was viewed by unauthorized parties, EHOA conducted a comprehensive review of the email contents to identify potentially exposed data. The review confirmed the presence of protected health information and personal data within the account during the intrusion period. EHOA maintained throughout its notification that it had not identified any evidence of actual or attempted misuse of the compromised information as of June 8, 2020.

The compromised email account contained patient information primarily consisting of first and last names from an internal report created for Centers for Medicaid and Medicare Service (CMS) reporting purposes. For certain individuals, additional sensitive data was present, including dates of birth, financial information, health insurance details, Social Security numbers, medical records, and treatment information. EHOA reported the incident to the U.S. Department of Health and Human Services (HHS), disclosing that 34,113 patients were affected by the breach. The organization did not publicly specify whether it implemented additional security measures beyond password resets or whether law enforcement was notified. No operational disruptions or system compromises beyond the single email account were described in EHOA’s public statement.

Sources

Sources available to members: 1 source.